Method and device for treating suspected errors

ABSTRACT

A method and a device are provided for producing an error signal and carrying out measures based thereon in a motor vehicle equipped with a wheel-slip control system and/or a wheel deceleration control system. At least one function variable representing the functionality of the wheel-slip control system and/or wheel-deceleration control system may be monitored for an error and if at least one error is detected, the value of at least one error counter may be incremented. When there is at least one detected error, at least one error signal may be output when the value of at least one error counter exceeds a predeterminable limiting value. For at least one error counter, at least two different, predeterminable limiting values coexist simultaneously, and when each of these is exceeded by the counter reading of the at least one error counter, different error signals may be output.

FIELD OF THE INVENTION

The present invention relates to a method and a device for producing anerror signal in a motor vehicle.

BACKGROUND INFORMATION

Published German Patent Application No. 196 38 280 discusses producingan error signal in a motor vehicle having at least two right and leftwheels situated in the rear and front region of the vehicle. Signalsrepresenting the rotational speeds of the wheels of the vehicle may berecorded. Depending on the signals recorded, the presence of corneringmay be furthermore recorded. The signals recorded during cornering maythen be compared according to the invention with a specified behaviorexisting during cornering, whereupon the error signal may be produced,depending on the comparison. Through the comparison, it may be possibleto detect incorrect rotational speed sensor signals as a result ofincorrectly connecting the wires, for example.

Published German Patent Application No. 196 36 443 discusses a deviceand a method of monitoring sensors in a vehicle. This device monitorssensors in a vehicle, which produce signals that each representdifferent physical variables. The device contains means with whichcomparative variables equally defined for the sensors are determined forat least two sensors, based on at least the signals they produced.Furthermore, the device contains other means with which a referencevariable is determined, based on at least the comparative variablesdetermined. Monitoring is carried out in the monitoring means at leastfor one sensor based on at least the reference variable determined.Aside from the monitoring means, the device contains additional means,with which at least for one sensor a correction of the signal itproduces is carried out at least based on the reference variable.

SUMMARY OF THE INVENTION

The present invention relates to a method and a device for treating asuspected error. It is based on a method of producing an error signaland carrying out measures based thereon in a motor vehicle equipped witha wheel-slip control system and/or a wheel deceleration control system,which

-   -   monitors for an error at least one function variable        representing the function of the wheel-slip control system        and/or wheel-deceleration control system, and    -   increments the value of at least one error counter if at least        one error is detected, and    -   outputs at least one error signal when the value of at least one        error counter exceeds a predeterminable limiting value.

Some aspects of the present invention are that

-   -   for at least one error counter, at least two different,        predeterminable limiting values coexist simultaneously, and when        each of these is exceeded by the counter reading of the at least        one error counter, different error signals are output, and    -   in response to the different error signals, different measures        are carried out in the wheel-slip control system and/or wheel        deceleration control system.

As a result, graduated measures may be allowed in the event of asuspected error. In the following, the term “wheel-slip control system”may be used for a clearer description. This may refer to a wheel-slipcontrol system and/or wheel deceleration control system.

For example, a monitoring device in a wheel-slip control system of amotor vehicle may detect a possible error. At the same time, however,the probability of there actually being an error is may not be so greatas to justify drastic countermeasures, such as the automatic shutdown ofthe wheel-slip control system. In this situation, the present inventionallows graduated countermeasures to be carried out. For example, when anerror is detected once, pressure build-up or pressure reductionprocedures affected by the wheel-slip control system may be slowed down.More drastic countermeasures may be taken if the error is detected againor repeatedly. Instead of pressure build-up and pressure reductionprocedures, general braking force buildup and braking force reductionprocedures may also be slowed down. The braking force buildup andbreaking force reduction are not hydraulically controlled inelectromechanical brakes (EMB). Therefore, the present invention may beapplicable to vehicles equipped with an electromechanical brake system.

An operative range of the present invention may then be provided whenthe wheel-slip control system is a vehicle dynamics control system,which regulates at least one variable representing the vehicle dynamicstoward a desired behavior.

It may be an advantage when the monitoring of at least one functionvariable representing the function of the wheel-slip control systemoccurs so that a verification of the fulfillment of at least one givencondition takes place.

As discussed above, a slowing down in the wheel brakes of the pressurebuild-up dynamics may be performed as the first measure when the lowestlimiting value is exceeded by one error counter.

It may in effect be generalized (for example, for the electromagneticbrake) that a slowing down of the braking force buildup procedure andbraking force reduction procedure is performed in the wheel brakes asthe first measure when the lowest limiting value is exceeded by oneerror counter.

As the second measure, for example, when the second lowest limitingvalue is exceeded by one error counter, the intervention threshold forat least one brake intervention of the vehicle dynamics control systemsis increased and/or at least one intervention of the vehicle dynamicscontrol systems is completely prohibited.

This may mean that, for example as a second measure, when the secondlowest limiting value is exceeded by one error counter, a greaterdeviation of at least one variable representing the vehicle dynamicsfrom its desired behavior is permitted before a control intervention ofthe vehicle dynamics control system takes place and/or as a secondmeasure at least one control intervention of the vehicle dynamicscontrol system is completely prohibited. Prohibiting a controlintervention by a vehicle dynamics control system may mean that at leastone type of intervention is completely prohibited, for example anintervention against oversteering, an intervention againstundersteering, or an intervention on a selected wheel.

A further monitoring measure may be as follows: the monitoring of atleast one function variable takes place such that a variable representedby the output signal of a vehicle sensor is compared with a variablecalculated through a mathematical model.

A variable represented by the output signal of a vehicle sensor may becompared only during certain driving states to a variable calculatedthrough a mathematical model. This may be related to the validity rangeof the mathematical model. If the vehicle is in a driving state in whichthe mathematical model is not valid, then the variable calculatedthrough the mathematical model may also no longer have any substantialsignificance.

A function variable may be understood as the voltage at one point of theelectronic circuit of the wheel-slip control system and/or wheeldeceleration control system. However, this may also be understood as theoutput signal of a sensor or a variable calculated from a mathematicalmodel.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows the principle sequence of the exemplary method for treatinga suspected error.

FIG. 2 shows a simple safety concept for a wheel-slip control system, inwhich the wheel-slip control system is switched off in the event of aknown error.

FIG. 3 shows a first safety concept for a wheel-slip control system, inwhich a suspected error is already detected before the error detection,and in response thereto, the pressure build-up dynamics in the wheelbrakes is slowed down in the course of brake applications induced by thewheel-slip control system.

FIG. 4 shows a second safety concept for a wheel-slip control system, inwhich a suspected error is already recognized before the errordetection, and in response thereto, the intervention thresholds of thevehicle dynamics control system are extended.

DETAILED DESCRIPTION

Possible monitoring measures on a wheel-slip control system include:

-   -   1. Hardware monitoring: The monitoring of the voltage level at        one point of the electronic circuit may be possible here, for        example.    -   2. Sensor monitoring: Since a wheel-slip control system may also        include sensors (for example, wheel speed sensors, a transverse        acceleration sensor, a steering angle sensor, a yaw rate sensor,        pressure sensors, etc.), monitoring of the sensors may be        possible. For instance, the output signal sent by a sensor may        be monitored to find out whether the value of this signal or of        the variable represented by this signal lies in a physically        reasonable or possible range. Monitoring of the change over time        of a variable represented by a sensor signal may also be        possible.    -   3. Model-supported monitoring: Some variables are two-fold. They        may be recorded by a sensor, and they may be determined from a        mathematical model. A comparison of the variable obtained from        the sensor signal with the variable determined from a        mathematical model may be provided here. In the process, the        scope of validity of the mathematical model may of course be        observed, meaning that a comparison during a driving state in        which the mathematical model is not valid may only have limited        significance.

Separate error counters may be allocated to different, fundamentallypossible errors. The fundamental procedure with respect to error counterk, which carries out a monitoring k, is illustrated in FIG. 1. Asidefrom error counter k, there may be other error counters 1, 2, 3, . . . ,k−1, k+1, . . . , N, which carry out monitorings 1, 2, . . . , k−1, k+1,. . . , N. There may be N error counters provided altogether.

Block 100 represents a signal source k, which sends one or more outputsignals to block 102 for monitoring. This signal source may be a sensor,for example, or the voltage at a particular point in the electroniccircuit of the wheel-slip control system, or the output signal of amathematical model. The output variable(s) sent by this signal source kmay be monitored in block 102. There may be a monitoring inquiry k forthis purpose. Through this monitoring inquiry, it may be verified, forexample, whether the output variable sent by signal source k is greaterthan a predeterminable limiting value. However, more complicatedinquiries are also possible. For instance, it may be verified whetherthe output variable sent by signal source k is greater than a firstpredeterminable limiting value (=minimum value) and at the same timesmaller than a second predeterminable limiting value (=maximum value).

It is also possible for signal source k to send multiple output signals,for example the output voltage to a connecting terminal of thewheel-slip control system as well as the temperature at a particularpoint of the wheel-slip control system. Combined monitoring inquiriesare also consequently possible. Such a monitoring inquiry could involveverifying whether the temperature falls below a particular,predeterminable value and at the same time whether a voltagesimultaneously exceeds another predeterminable value, for example.

Another combined monitoring inquiry may involve a comparison between thevariable obtained from a sensor signal and the variable determined froma mathematical model.

According to a flow chart, block 100 may also be interpreted as readingin data. The type of this data was illustrated in the previousparagraph.

If monitoring inquiry 102 shows that the signal sent by signal source100 fulfills all the conditions, i.e., it is plausible, error counter ikin block 101 may be reset to zero. Error counter ik may contain thenumber of times that monitoring inquiry k was not fulfilled asdetermined within an uninterrupted sequence. Afterwards, the outputsignals of signal source 100 may be monitored anew, i.e., at least onevariable is read in.

However, if monitoring inquiry 102 shows that the output signal (oroutput signals) from block 100 does not fulfill all the requiredconditions, there may be an error. For this reason, value ik of theerror counter may be increased by one in block 103. An inquiry as towhether ik>N1 takes place in block 104. Here, N1 may be apredeterminable limiting value. If this condition is not fulfilled, thenthere may be a branching back to block 100. If this condition isfulfilled, the next verification of ik may follow in block 105: ik>N2.

Here, N2 may be greater than N1.

If the condition in block 105 is not fulfilled, it means that ik isgreater than N1 but less than N2. First measures are now thereforeinitiated in block 106. These first measures may involve a slowing downof the pressure build-up dynamics or pressure reduction dynamics of thewheel-slip control system, for example. Instead of pressure build-up andpressure reduction, these may be power buildup and power reduction, asis the case in the electromechanical brake.

This fact is explained briefly again:

-   -   Through ik>N1, it may be detected that there was probably an        error in the wheel-slip control system.    -   But because ik may be even less than N2, it may not yet be        certain that there is really an error.    -   The first measures described may therefore be initiated, for        example.    -   The point of the first measures lies in the example that the        wheel-slip control system may continue to perform all the        necessary interventions, albeit somewhat slower. As a result,        time may be gained for a further verification of the suspected        error.

However, if ik>N2 in block 105, a further inquiry ik>N3 may subsequentlyfollow in block 107. Here, N3>N2.

If ik is not greater than N3, second measures may be initiated in block108 that may possibly have greater effects on the wheel-slip controlsystem. In the example of a vehicle dynamics control system (ESP, FDR),this may mean that the intervention thresholds of some controlinterventions are increased or that some interventions are evencompletely prohibited.

If it is determined in block 107 that ik>N3, third measures may beinitiated in block 109. These third measures may involve relevantfunctions of the wheel-slip control system being switched off or eventhe entire wheel-slip control system being switched off, for example. Ifik>N3, there may be a strong likelihood of an error in the wheel-slipcontrol system or in a component. Block 109 may be connected to block100 through a broken line. This may have to do with the fact that a newmonitoring cycle may begin again in block 100. However, it may also bepossible to dispense with further monitorings in a completely switchedoff wheel-slip control system.

As discussed above, there may be separate error counters for separateerrors. The method illustrated in FIG. 1 may also be logicallytransferable to the other error counters. In a particular embodiment, itmay be possible for each of the first measures carried out to beidentical when different counter errors have reached the appropriatelimiting values. The same may also apply to the second and thirdmeasures.

However, it is may also be possible to carry out different measures,depending on the type of error detected (i.e., by the error counter).

Furthermore, it may be possible to individually select limiting valuesN1, N2 and N3 for all error counters. As a result, for non-seriouserrors it may be possible to select higher intervention limiting valuesN1, N2 and N3 than for serious errors, for example. However, it is maybe possible for N1, N2 and N3 to assume the same values for all errorcounters.

In FIG. 1, the first, second, and third measures were taken as anexample, depending on the status of the error counter. It may bepossible to make the measures even more precisely graduated, i.e., theremay be still fourth measures, fifth measures, etc. However, it may alsobe possible to make do with only two graduated measures.

Concrete exemplary embodiments of the safety concept discussed ingeneral in FIG. 1 are illustrated in FIGS. 2 to 4. Since these figuresare all quite similarly designed, the general design should first beexplained. This assumes a wheel-slip control system designed as avehicle dynamics control system.

Each of these figures is made up of two diagrams. In the upper diagram,different variables a(t) (ordinate) are respectively plotted as afunction of time t (abscissa). This will now be explained in order.

-   -   The topmost signal 200 describes the state of the pump motor of        the wheel-slip control system as a binary signal course. This is        the motor of the return pump, which may provide the active        pressure build-up (i.e., without assistance from the driver). If        this signal assumes its ‘low’ value, the pump motor may be        switched off. If the signal assumes the ‘high’ value, the pump        motor may be switched on.    -   As the next signal, the yaw rate vGi measured with a yaw rate        sensor is plotted. This may be assumed to be constant over time        in all cases, i.e., there may be a horizontal straight line. The        curly bracket 210 may indicate the hatched range specifying the        allowed controller tolerance range of the yaw rate. This concept        will be discussed later in greater detail.    -   As a third signal from above, yaw rate vGiLw calculated via a        mathematical model is drawn with broken lines. The single-track        model, also known as the Ackermann Function, may be suitable as        a mathematical model, for example. The yaw rate may be computed        therein from the steering angle, the vehicle longitudinal        velocity, as well as other parameters.    -   As a fourth and final signal from above, variable p is drawn in        as a function of time. p may be a measure of the built-up        pressure in a selected wheel brake cylinder.

In the lower of the two diagrams, the measured yaw rate vGi, thecomputed yaw rate vGiLw, as well as the controller tolerance range ofthe yaw rate in hatched pattern are again drawn in. The controllertolerance range in the ordinate direction may be somewhat narrower thanillustrated in the upper diagram. This is for reasons of clarity.However, the state of error counter F(t) was included as additionalcurve 220. In this situation, the state of the error counter may beshown as a continuously rising straight line for reasons of clarity. Thestate of the error counter may possibly be a discrete, whole number,i.e., this may also be a step function. This distinction may not berelevant for the following considerations, however.

FIG. 2 is discussed first. To this end, measured yaw rate vGi may firstbe compared in the upper diagram with computed yaw rate vGiLw. Thevalidity of the mathematical model may be required over entire time axist for computing yaw rate vGiLw. At time t1, a sensor error 230 (seelightning symbol in the lower diagram) of the steering angle sensor, forexample, may occur. It may be assumed that the steering angle entersinto the computation of yaw rate vGiLw. A sudden deviation between vGiand vGiLw therefore may occur at time t1. This deviation may be so greatthat vGiLw even drops out of the controller tolerance range of yaw ratevGi. This may have two consequences:

-   -   1. The vehicle dynamics control system may erroneously detect a        deviation between the setpoint and the actual yaw rate. A        control intervention may thus be started, recognizable by the        switching on of the pump as well as by the accretion of pressure        p in the upper diagram.    -   2. Value F(t) of the error counter allocated to this error in        the lower diagram may begin to rise. This may have to do with        the fact that with every repeated monitoring (see FIG. 1, block        102), a difference between the two yaw rates (vGi and vGiLw),        and, consequently, another suspected error, may be determined.        At time t=t2, the value of the error counter may have reached        the value F1, i.e., the error is deemed detected with enough        certainty. This is indicated by lightning symbol 240. The        control intervention of the vehicle dynamics control system may        therefore be terminated again at time t2. For that, pump 200 is        switched off and pressure p may again taper off.

Lightning symbol 230 also appears in FIGS. 3 and 4 with the samemeaning.

In FIG. 3, lightning symbol 250 is drawn in in addition to time t3 (witht3<t2). At time t3, the error counter may have already reached a firstlimiting value F2. The dynamic restriction of the pressure may thereforebe activated at time t3 (first measure). This may be seen in theincrease in pressure in the upper diagram, which may be more gradualthan in FIG. 2. This may mean that the control intervention of thevehicle dynamics control system is taking place at a slower pace. Attime t2, the error counter may have even reached the second (and higher)limiting value F1. A positive error may have now been detected andpressure p may again be reduced. As a result of the previous firstmeasure, only a little pressure may need to be reduced. The effects ofthe erroneous brake application of the vehicle dynamics control systemmay have remained weaker than in FIG. 2.

A further exemplary embodiment of the present invention is illustratedin FIG. 4. At time t1, the control intervention of the vehicle dynamicscontrol system may begin again erroneously. This may be seen in theupper diagram in pressure p, which has started to increase. The countererror reaches value F3 at time t4. A suspected error may be detected,characterized by lightning symbol 260. As a result of the suspectederror, an extension of the intervention threshold of the vehicledynamics control system may take place. This may be drawn with a hatchedpattern in the upper diagram and marked with the curly bracket 211.Since the control tolerance range of the vehicle dynamics control systemmay have now become wider, the computed value vGiLw for t>t4 may onceagain fall within the control tolerance range of vGi. The interventionof the vehicle dynamics control system may therefore be cancelled. Thismay be seen in the pressure reduction in the upper diagram. At the sametime, the pump may be again switched off. At time t5, the value of theerror counter may exceed a second limiting value. This may be marked bylightning symbol 270. The error may now be deemed detected withcertainty and second measures may be initiated.

As already mentioned, varied error counters for varied monitoringmeasures may be possible. Not only may a detected error be used to limitthe functions of the wheel-slip control system, but the cause of theerror may possibly be directly determined and logged, stored, or outputas driver information in some form. This may facilitate a subsequentdiagnosis, for example during a service inspection, and results inshortened service visits. This may bring about considerable costsavings.

In the present invention, it may be helpful to distinguish between twotypes of errors:

-   -   1. Component errors are the errors that may clearly be allocated        to one component.    -   2. System errors are errors whose cause cannot be clearly        determined.

The information on whether it is a component or a system error maytherefore be allocated to each error counter. This information may beavailable for subsequent diagnosis.

Should an error that has been detected at least once suddenly no longerappear in the next monitoring (see block 102 in FIG. 1), the errorcounter may be reset to zero in FIG. 1 in block 101.

Alternatively, there may also be the following possibility for resettingthe error counter:

-   -   counting with the error counter may alway take place within an        ignition cycle.    -   when a monitoring-specific suspected error occurs, the error        counter may be incremented by a predeterminable value,        e.g., 1024. Since this may often be implemented as a filter, the        use of a number associated with the filter may be recommended.    -   if the suspected error is not reset, the error counter may be        decremented each time by one bit in a 5.12-second pattern, for        example. This may mean that after a time of 1024*5.12 seconds        (approximately 1.5 hours), a suspected error that has been set        once may be forgotten.

An exemplary embodiment of the present invention may have a usefuloperative range in motor vehicles equipped with an electrohydraulicbrake. This may have shorter response times than a conventionalhydraulic brake. A control intervention of a vehicle dynamics controlsystem may then be noticeable to the driver when a brake pressure ofapproximately 20 bar has built up. A conventional hydraulic brake systemmay need about 200 milliseconds for this, while an electrohydraulicbrake system may only need 20 milliseconds. Shortened error detectiontimes may therefore be particularly advantageous here. The proposed,exemplary multistage error detection method may facilitate robust errordetection almost regardless of the speed of the actuators.

Finally, some significant aspects of an exemplary embodiment of thepresent invention may be summarized:

-   -   The exemplary method is based on the concept of responding to a        two-stage or multistage suspected error at the start of the        error detection time.    -   In the first stage of suspecting an error, the pressure build-up        dynamics may be limited. The effects of possible erroneous        interventions (until the second stage of the suspected error is        set) may consequently be reduced.    -   In the second stage of suspecting an error, the vehicle        controller intervention thresholds may be extended. With this        measure, vehicle control interventions may be suppressed and        time may be gained for robust and certain detection of the        error.    -   Since there may be more time for error detection (longer error        detection time), it may be easier to clearly allocate system        errors to component errors.    -   Counting the occurrence of a suspected error may also allow the        recording of errors caused by a loose connection.

1. A method for producing at least one error signal and performing atleast one measure based on the at least one error signal in a motorvehicle equipped with at least one of a wheel-slip control system and awheel deceleration control system, comprising: monitoring for at leastone error in at least one function variable, the at least one functionvariable representing a functionality of the at least one of thewheel-slip control system and the wheel deceleration control system;incrementing a value of at least one error counter if the at least oneerror is detected; and outputting the at least one error signal when thevalue of the at least one error counter exceeds a predetermined limitingvalue, wherein, for the at least one error counter, at least a first anda second predetermined limiting values coexist simultaneously, andwherein a first error signal is output when the first limiting value isexceeded by a counter reading of the at least one error counter, and asecond, different error signal is output when the second limiting valueis exceeded by a counter reading of the at least one error counter; andwherein, in response to the first and second error signals,correspondingly different measures are performed in the at least one ofthe wheel-slip control system and the wheel deceleration control system.2. The method of claim 1, wherein the at least one of the wheel-slipcontrol system and the wheel deceleration control system includes avehicle dynamics control system, the vehicle dynamics control systemregulating at least one variable representing a vehicle dynamics, towarda desired state.
 3. The method of claim 1, wherein the monitoring of theat least one function variable is performed so that a verification of afulfillment of at least one given condition is performed.
 4. The methodof claim 1, wherein a slowing down of at least one of a braking forcebuildup procedure and a braking force reduction procedure is performedin a wheel brake as a first measure when a lowest limiting value isexceeded by the at least one error counter.
 5. The method of claim 4,wherein a second measure is performed when a second lowest limitingvalue is exceeded by the at least one error counter, the second measurebeing at least one of: a greater deviation of at least one variablerepresenting a vehicle dynamics from a desired state is permitted beforea control intervention of the vehicle dynamics control system isperformed; and at least one control intervention of the vehicle dynamicscontrol system is completely prohibited.
 6. The method of claim 3,wherein the monitoring of at least one function variable is performed sothat a first variable represented by an output signal of a vehiclesensor is compared with a second variable calculated using amathematical model.
 7. The method of claim 6, further comprising:comparing, only during certain driving states, the first variable to thesecond variable.
 8. The method of claim 1, wherein the at least onefunction variable includes one of: a voltage at one point of anelectronic circuit of the at least one of the wheel-slip control systemand the wheel deceleration control system; an output signal of a sensor;and a variable calculated from a mathematical model.
 9. A device forproducing at least one error signal and carrying out at least onemeasure based thereon in a motor vehicle equipped with at least one of awheel-slip control system and a wheel deceleration control system,comprising: a monitoring arrangement adapted to monitor for at least oneerror in at least one function variable, the at least one functionvariable representing a functionality of the at least one of thewheel-slip control system and the wheel-deceleration control system; anerror counter adapted to increment an error count if the at least oneerror is detected; and an error-signal producing arrangement foroutputting the at least one error signal when the value of the errorcounter exceeds a predetermined limiting value, wherein, for the atleast one error counter, at least a first and a second predeterminedlimiting values coexist simultaneously, and wherein a first error signalis output when the first limiting value is exceeded by a counter readingof the at least one error counter, and a second, different error signalis output when the second limiting value is exceeded by a counterreading of the at least one error counter; and wherein, in response tothe first and second error signals, correspondingly different measuresare performed in the at least one of the wheel-slip control system andthe wheel deceleration control system.